{
  "id": 15616550,
  "title": "WebDAV over HTTPS: what you actually need",
  "url": "https://urgent.news/2026/10/19/webdav-over-https-what-you-actually-need",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-19T15:19:07.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/scsoi/webdav-over-https-what-you-actually-need-3nfm"
  },
  "original_language": "en",
  "account": "WebDAV over plain HTTP reveals your password, as demonstrated by the ability to sniff Basic Auth credentials transmitted in base64. To secure WebDAV, employ HTTPS in production environments. When comparing authentication methods, Basic Auth offers medium security but remains compatible with virtually all clients. Bearer or token-based authentication, often used in OAuth2 and Nextcloud setups, provides easy implementation and strong security. Digest Auth, while offering higher security, is less universally supported. Client certificate authentication represents the highest level of security but is niche and requires self-signed PKI.\n\nFor home NAS devices, Basic + HTTPS suffices. Public or multi-tenant setups, however, benefit from Digest or OAuth2 + Bearer authentication. Enterprise environments typically employ client certificates along with secure credential storage solutions.\n\nWhen configuring a WebDAV server on platforms like Synology or QNAP, it uses a self-signed certificate. Browsers issue warnings upon the first encounter. To proceed, either import the exported .crt file into your OS's trust store (Windows users can do this through certmgr.msc) or use Let's Encrypt on the NAS, which supports automatic certificate renewal every 90 days. Firewall configuration should block HTTP/80 entirely, opening only HTTPS/443 (or 5006 for Synology) to prevent unauthorized access.\n\nClients store credentials differently, utilizing encryption mechanisms like RaiDrive's Windows Credential Manager, Cyberduck's Plaintext (default) or custom encryption, and macOS Finder's Keychain. Sharing a device without proper precautions leaves credentials vulnerable to unauthorized access. Implementing end-to-end encryption (E2EE) on top of HTTPS can further protect sensitive data, with options like rclone crypt or Cryptomator offering AES-encrypted file names and content. However, combining multiple encryption layers without proper key management can lead to key loss and security breaches. Following these guidelines ensures a secure WebDAV setup tailored to individual needs and risk profiles.",
  "summary": "WebDAV over plain HTTP exposes your password. Here's how HTTPS + auth choice works in practice. TL;DR WebDAV defaults to HTTP/80. If you expose a WebDAV server to the public internet without TLS, anyone on your WiFi can sniff your base64-encoded Basic Auth credentials in a few seconds. Always use HTTPS in production. Auth choices side-by-side Method Security Compatibility Notes Basic Auth Medium…",
  "key_points": [
    "WebDAV over HTTP exposes credentials during sniffing",
    "HTTPS secures WebDAV in production environments",
    "Basic Auth offers medium security for home NAS"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}